ipfix
An ArrayRecord represents the data for an individual Record that is being built from instances of objects.
An ArrayRecord represents the data for an individual Record
that is being built from instances of objects. In the ArrayRecord
class, fields are always accessed by position, where field i
represents the data for InfoElement i in the Template.
The ExportRecord class is similar to this class, except ExportRecord is abstract and allows the subclass to reference information elements by name.
When creating a record from a buffer containing serialzed data, the CollectedRecord class should be used.
An ArrayRecord is created from a Template. The value for
each information element in the Record is
initially set to its default value (0 for values and null for
references). The update() method is used set the values.
val template = Template.newTemplate(Seq( IEFieldSpecifier(model, "sourceIPv4Address", 4), IEFieldSpecifier(model, "flowStartTimeMilliseconds", 8), IEFieldSpecifier(model, "packetTotalCount", 8)), session) val rec = ArrayRecord(template) rec(0) = org.cert.netsa.data.net.IPv4Address("10.1.2.3") rec(1) = java.time.Instant.now() rec(2) = 365
The companion object for more details.
A class to represent the contents of an IPFIX BasicList structured data.
A class to represent the contents of an IPFIX BasicList structured data.
A BasicList contains a zero or more instances of a single IPFIX Information Element.
Use the CollectedBasicList subclass when reading a BasicList, and the ExportBasicList subclass when generating a BasicList for writing.
The companion object has factory methods that return a CollectedBasicList instance when reading a BasicList or a ExportBasicList instance when generating a BasicList for writing.
Extracts a BasicList from a Record.
A ByteBufferMessageReader is used to get the next Message from a byte buffer.
The CollectedBasicList class is used when reading a BasicList from a data stream.
The CollectedBasicList class is used when reading a BasicList from a data stream. The class delays realizing the elements of this until they are requested.
Use the methods in the BasicList companion object to create a CollectedBasicList instance.
The BasicList companion object for a factory method.
The CollectedMessage class interprets a ByteBuffer to provide an Iterator over the IpfixSets in the buffer.
The CollectedMessage class interprets a ByteBuffer to provide an Iterator over the IpfixSets in the buffer.
The companion object for more details
A CollectedRecord represents the data for an individual Record that has been created when a Template interprets a ByteBuffer.
A CollectedRecord represents the data for an individual Record that has been created when a Template interprets a ByteBuffer.
To create a Record from existing objects, use the ArrayRecord class or extend the ExportRecord abstract class.
The companion object for more details
The CollectedSubTemplateList class is used when reading a SubTemplateList from a data stream.
The CollectedSubTemplateList class is used when reading a SubTemplateList from a data stream. The class delays realizing the elements of this until they are requested.
Use the methods in the SubTemplateList companion object to create a CollectedSubTemplateList instance.
The SubTemplateList companion object for a factory method.
The CollectedSubTemplateMultiList class is used when reading a SubTemplateMultiList from a data stream.
The CollectedSubTemplateMultiList class is used when reading a SubTemplateMultiList from a data stream. The class delays realizing the elements of this until they are requested.
Use the methods in the SubTemplateMultiList companion object to create a CollectedSubTemplateMultiList instance.
The SubTemplateMultiList companion object for a factory method.
The DataType trait defines members that must exist on classes that provide an implementation of each possible DataTypes value, where those values represent an IPFIX Information Element Data Types as defined in RFC5102.
IPFIX Information Element Data Types as defined in RFC5102
IPFIX Information Element Data Types as defined in RFC5102
The companion object for a complete description and the list of values.
There are two types of Sessions: StreamSession and DatagramSession.
There are two types of Sessions: StreamSession and DatagramSession.
A DatagramSession implements template instantiation and template withdrawal handling as dictated by section 8.4 of RFC 7011.
A DatagramSession is created by a SessionGroup with the
streamSemantics parameter set to false.
Extracts the specified field from a Record or a Sub-Record and casts the field to a type.
Extracts the specified field from a Record or a Sub-Record and casts the field to a type.
A simple string returns the named IE in the top-level record:
val protoEx = DeepFieldExtractor[Short]("protocolIdentifier") val proto = protoEx.extractFrom(r.get) proto: Option[Short] = Some(6)
One or more template names may preceed the named IE. Separate the
sequence of template names and the IE by
DeepFieldExtractor$.delim.
val initialTcpEx = DeepFieldExtractor[Short]("yaf_tcp_rev/initialTCPFlags") val initialTcp = initialTcpEx.extractFrom(r.get) initialTcp: Option[Short] = Some(2)
Prepend the DeepFieldExtractor$.deepPrefix to either a lone IE
name or a template name and IE sequence to start searching for the
path at any depth within the Record.
val unionTcpEx = DeepFieldExtractor[Short]("* /unionTCPFlags") val unionTcp = unionTcpEx.extractFrom(r.get) unionTcp: Option[Short] = Some(28)
To get a BasicList containing a specific IE from a Record, wrap
the IE's name ieName as "basicList[ieName]" (see
DeepFieldExtractor$.wrapAsBasicList). For these, the type
parameter T should always be BasicList.
val agentEx = DeepFieldExtractor[BasicList]("* /basicList[httpUserAgent]") val agent = agentEx.extractFrom(r.get) agent: Option[org.cert.netsa.io.ipfix.BasicList] = Some((BL ...))
Use the BasicList's elements method to get the contents of the
BasicList:
val v = Vector.empty[String] ++ agent.get.elements
Maintains a mapping from Template to field position to improve performance when extracting a field from multiple Records that share the same Template.
The type to cast the field to.
SimpleFieldExtractor for a simplified version
Signals that the end of file has been reached.
The ExportBasicList class is used to incrementally build a BasicList and export it to a stream.
The ExportBasicList class is used to incrementally build a BasicList and export it to a stream.
Use the methods in the BasicList companion object to create an ExportBasicList instance.
The BasicList companion object for factory methods.
An ExportRecord represents the data for an individual Record that is being built from instances of objects.
An ExportRecord represents the data for an individual Record that is being built from instances of objects. The ExportRecord class supports subclasses that use class members to represent the values for the information elements of a Template.
When creating a record from a buffer containing serialzed data, the CollectedRecord class is used.
The ArrayRecord class is similar this class, except
ArrayRecord is concrete and fields are always accessed by
numeric position. The ExportRecord class allows the caller to
reference members by name or by position; the class may have
default values for elements. The ExportRecord class forces
the caller to provide a class member for each element in the
Template whereas the elements of ArrayRecord are represented
by an Array[Any].
The caller extends this class, adds members that represent the elements in the class, annotates those members with the IPFIXExtract class, and defines a corresponding template. The caller may then instantiate the class and reference members by name.
class MyRec(template: Template) extends ExportRecord(template) { @IPFIXExtract(name = "sourceIPv4Address") var sip = org.cert.netsa.data.net.IPv4Address("0.0.0.0") @IPFIXExtract(name = "flowStartTimeMilliseconds") var stime = java.time.Instant.EPOCH @IPFIXExtract(name = "packetTotalCount") var packets: Long = 0L // may add other members } val template = Template(Seq( IEFieldSpecifier(model, "sourceIPv4Address", 4), IEFieldSpecifier(model, "flowStartTimeMilliseconds", 8), IEFieldSpecifier(model, "packetTotalCount", 8))) val rec = new MyRec(template) rec.sip = org.cert.netsa.data.net.IPv4Address("10.1.2.3") rec.stime = java.time.Instant.now() rec.packets = 365
ExportStream supports writing IPFIX templates and records to a file.
ExportStream supports writing IPFIX templates and records to a file.
The caller creates an ExportStream instance with an output channel and an associated Session. The caller may then add Templates or Records to the ExportStream, and the ExportStream writes the IPFIX data to the output file.
Since the Session is part of the ExportStream's constructor, all IPFIX Messages in the stream use the same observation domain.
By default, each exported IPFIX Message uses the current time
as its timestamp. Set the makeTimestamp variable to change this
behavior.
By default, an ExportStream adds an options record to describe
each Information Element that is not part of the
standard information model, and ExportStream ignores any such
options records in the input stream. Set the describeElements
variable to false to change this behavor, and use
elementDescriptionTID to view or set the template ID used by
these records.
By default, an ExportStream adds an options record to describe
each Template it exports, and ExportStream ignores any such
options records in the input stream. Set the describeTemplates
variable to false to change this behavor, and use
templateDescriptionTID to view or set the template ID used by
these records.
NOTE: When copying data from an IPFIX input stream, ExportStream may change the order in which templates and records appear---specifically, templates that appear after a record in the input may be written before that record. ExportStream is aware of the Meta-Data Options templates and records that describe Information Elements and Templates, and, when ExportStream is not creating and exporting those items itself, those templates and records are copied from the input and written to the output in the required order. The user may call flush() to ensure some items appear in the output before others. The authors of this package may need to consider providing some way for the users to know when to call flush(), such as adding a callback methods to be invoked when a new IpfixSet is read.
ExportStreamTemplatesFirst extends the ExportStream class to ensure that Templates occur in the output stream before Records.
ExportStreamTemplatesFirst extends the ExportStream class to ensure that Templates occur in the output stream before Records.
Instances of this class only produce output when the close() method is called.
Note: When template metadata or information element metadata is being written to the stream, those records may appear before some templates.
The ExportSubTemplateList class is used to incrementally build a SubTemplateList and export it to a stream.
The ExportSubTemplateList class is used to incrementally build a SubTemplateList and export it to a stream.
Use the methods in the SubTemplateList companion object to create an ExportSubTemplateList instance.
The SubTemplateList companion object for factory methods.
The ExportSubTemplateMultiList class is used to incrementally build a SubTemplateMultiList and export it to a stream.
The ExportSubTemplateMultiList class is used to incrementally build a SubTemplateMultiList and export it to a stream.
Use the methods in the SubTemplateMultiList companion object to create an ExportSubTemplateMultiList instance.
The SubTemplateMultiList companion object for factory methods.
A Field represents the value of an InfoElement in a Record as determined by the Record's Template.
A Field represents the value of an InfoElement in a Record as determined by the Record's Template.
The information element that describes this field,
The value of the field within a Record.
The length of the field as described by the IEFieldSpecifier that was used to contruct the Record's Template.
The position of this field within the Record, where 0 indicates the first field, 1 the second field, etc.
A FieldExtractor may be used to extract data from a Record.
A FieldExtractor may be used to extract data from a Record. It
may be used directly via the extractFrom method, or more commonly
may be used as an operand to a Record, like
rec(fieldExtractor).
Extractors are meant to be more than a simple index into a record. Rather, they can retrieve any data based on a record, based on that record's template and values. Common uses of extractors are to extract data from a particular field regardless of the actual template being used, or to generate a computed value based on fields in a record, such as returning a string value for a field that is encoded as an integer.
The type parameter T is a convenience feature. Implementations of
FieldExtractor normally have to use rec(i) under the hood, which returns Any. As such, a cast will
be made at some point, and a ClassCastException may be thrown if
care is not taken. It is suggested that implementers of objects that
implement FieldExtractor should include a constructor that takes
the class type as an argument, and do type checking based on the
record field type in order to throw an error during extractor
construction rather than during use.
the type the extractor should return
Record
A FieldSpec is used to locate an InfoElement within an existing Template.
A FieldSpec is used to locate an InfoElement within an existing Template.
IEFieldSpecifier if you are attempting to include an Information Element in new a Template.
The companion object for more details
A class which mixes in the Fillable trait may be used as a target of a Record's fill() method.
A class which mixes in the Fillable trait may be used as a target of a Record's fill() method.
A class which mixes in Fillable must use the IPFIXExtract annotation to mark the variables that it wishes to be filled with the information element values from a Record. If a variable is marked but the corresponding element is not present in the record from which the object is being filled, the variables's value is left unchanged.
The IPFIXExtract annotation defines two values that are used to create a FieldSpec that is used to specify which element in the Record is to used to fill the annotated variable. The two values are:
name is a String and must be specified: it is
the name of the information element to use.nth is an int that is optional: it specifies which name
element to choose when multiple name elements are present on
the record; the first name field is chosen when nth is not
specified.It is important that the types of the variables in the Fillable object match the IPFIX data types of the referenced IPFIX fields. If they do not, a java.lang.ClassCastException will be thrown when the record is filled. See Record for a mapping from IPFIX data type to Java data type.
Here is a class whose sport and dport variables can
be filled by a record's sourceTransportPort and
destinationTransportPort elements:
class Ports extends Fillable { @IPFIXExtract(name="sourceTransportPort") var sport: Int = _ @IPFIXExtract(name="destinationTransportPort") var dport: Int = _ }
A single IPFIX Information Element specification for inclusion of an Information Element when constructing a Template.
A single IPFIX Information Element specification for inclusion of an Information Element when constructing a Template.
IllegalFieldSpecifierException if length is negative or
larger than VARLEN.
FieldSpec if you are attempting to locate an Information Element within an existing Template.
The companion object for more details
IPFIX Information Element Semantics as defined in RFC5610
IPFIX Information Element Semantics as defined in RFC5610
The companion object for a complete description and the list of values.
IPFIX Information Element Units as defined in RFC5610
IPFIX Information Element Units as defined in RFC5610
The companion object for a complete description and the list of values.
Signals that an exception has occurred during IPFIX processing.
An Information Element Identifier provides a way to identify an Information Element of an Information Model.
An Information Element Identifier provides a way to identify an Information Element of an Information Model. The Identifier is also used when creating a Field Specifier.
An Identifier consists of two numbers: an Element ID and an optional Private Enterprise Number (PEN). An absent PEN is represented as a zero value. The valid range of the Element ID is 1 to 32767 (0x7fff) inclusive. The valid range of Enterprise ID is 1 to 4294967295 (0xffffffff).
The numeric identifier for the element.
The PEN for the element.
IllegalInfoElementAttributeException when both the
elementId and enterpriseId are 0, when the elementId is negative
or larger than 32767 (0x7fff), or when the enterpriseId is not
representable as an unsigned 32-bit number.
Signals that there are too few bytes for a BasicList or that the specifier in the list is invalid.
Signals that an attribute of an information element is invalid.
Signals an error processing a ListElement.
Signals an error processing a ListElement. A parent class for more-specific list exceptions.
Signals that an IpfixSet ID is invalid.
Signals that there are not enough bytes for the SubTemplateList or that the Template ID for the list is not available.
Signals that there are not enough bytes for the SubTemplateMultiList or that a length specified within the list is too short.
Signals that a Template record is invalid.
Information in messages of the IPFIX protocol is modeled in terms of Information Elements of the IPFIX information model.
Information in messages of the IPFIX protocol is modeled in terms of Information Elements of the IPFIX information model. The InfoElement class represents a single Information Element.
Typically an InfoElement is created either by parsing an XML file that describes a set of Information Elements or by using the InfoElementBuilder class.
InvalidInfoElementException if name's length is 0, if
rangeMin is greater than rangeMax, or if the elementId and
enterpriseId of the ident are both 0.
The companion object for more details
The InfoElementBuilder class is used to create new InfoElements.
The InfoElementBuilder class is used to create new InfoElements.
An empty builder may be created, or a builder may be created based on an existing InfoElement.
Extracts Information Element metadata from a Record.
Extracts Information Element metadata from a Record.
The extracted data fully describes an Information Element. The RecordReader uses that information to add the Information Element to the Information Model.
The InfoModel class represents the IPFIX Information Model.
The InfoModel class represents the IPFIX Information Model.
The Information Model contains Information Elmenets.
To use the standard IPFIX Information Model, the caller invokes
the getStandardInfoModel() method on the companion
object. If necessary, that function reads the standard model
from an XML file. The caller is given an empty model that
inherits from the standard model. This allows the caller to
manipulate the information model without invalidating the standard
model or disrupting other threads.
The companion object for more details.
An InputStreamSession takes a readable channel, a file path, or
an input stream, creates a StreamMessageReader to read
Messages from the stream, creates a RecordReader
to parse the messages into Records, and wraps the
RecordReader's call() method.
Signals that an exception has occurred during IPFIX processing.
Signals that an information element is invalid.
The IpfixSet class represents an IPFIX Set.
The IpfixSet class represents an IPFIX Set. (The name is "IpfixSet" to avoid conflicts with the standard Scala Set).
A Set is a generic term for a collection of records that have a similar structure. A Set consists of a 4-byte Set Header and one or more records.
There are three types of Sets: (1)Data Sets contain IPFIX flow records and are represented by the RecordSet class. (2)Template Sets and (3)Option Template Sets contain templates (or schemas) that describe the representation of the data in Data Sets. They are represented by the TemplateSet class.
To create a Set from IPFIX data stored in a ByteBuffer that was read as part of message, use
val set = IpfixSet.fromBuffer(buffer, message)1.3.1 This class was previously called Set.
The companion object for more details
An abstract class that represents an element in a Record that is a structured data; i.e., a BasicList, a SubTemplateList, or a SubTemplateMultiList.
IPFIX Structured Data (List) Type Semantics as defined in RFC6313
IPFIX Structured Data (List) Type Semantics as defined in RFC6313
The companion object for a complete description and the list of values.
An IPFIX stream consists of Messages, which contain Sets (represented by the IpfixSet class).
An iterator over incoming Messages that includes additional members needed to interpret the Messages.
Signals an attempt to put more octets into a Message than the IPFIX protocol allows.
Signals that all possible Template IDs have been used.
A Record instance represents an IPFIX data record.
A Record instance represents an IPFIX data record. Each record contains a set of values which are described by the record's Template.
Each IPFIX data type can be mapped to its Java data type as in the table below:
octetArray ⟶ Seq[Byte]1unsigned8 ⟶ Intunsigned16 ⟶ Intunsigned32 ⟶ Longunsigned64 ⟶ Long2signed8 ⟶ Intsigned16 ⟶ Intsigned32 ⟶ Intsigned64 ⟶ Longfloat32 ⟶ Floatfloat64 ⟶ Doubleboolean ⟶ BooleanmacAddress ⟶ Seq[Byte]1,3string ⟶ StringdateTimeSeconds ⟶ InstantdateTimeMilliseconds ⟶ InstantdateTimeMicroseconds ⟶ InstantdateTimeNanoseconds ⟶ Instantipv4Address ⟶ IPv4Addressipv6Address ⟶ IPv6AddressbasicList ⟶ BasicListsubTemplateList ⟶ SubTemplateListsubTemplateMultiList ⟶ SubTemplateMultiList1 The Seq[Byte] returned for octetArray or
macAddress is a read-only view on the underlying record data. If
you want to save the data without keeping the full record data
from being garbage collected, you should copy the Seq.
2 Long is signed, so an unsigned64 with its high
bit set will appear as negative.
3 The Seq[Byte] returned for a macAddress will
always be of length 6.
A record's fields are described by a Template, which may be retrieved from the record using the #template value. Using the data from the template, the user can cast the record's objects to the appropriate Java type.
Alternatively, a record's values can be retrieved in a typed manner using either a FieldExtractor, or a Fillable object. A FieldExtractor acts as a reference to a particular field in a record regardless of the current template of the record. A Fillable object is an object which contains fields that have been marked with the IPFIXExtract annotation. A record's fill() method can be used to "fill in" the object's fields from the record.
A RecordReader is an Iterator over the CollectedRecords found in Messages read from a MessageReader.
A RecordReader is an Iterator over the CollectedRecords found in Messages read from a MessageReader.
The object that provides Messages from which to read records
A RecordSet represents an IpfixSet that contains one or more Data Records.
A RecordSet represents an IpfixSet that contains one or more Data Records.
To create a RecordSet from an input ByteBuffer, call IpfixSet.fromBuffer().
To create a RecordSet for export, use RecordSet.empty() to create an empty RecordSet and then call addRecord() to add Records to it.
The companion object for more details.
A session contains information about a single IPFIX session, from a single observation Domain.
A session contains information about a single IPFIX session, from a single observation Domain. Specifically, a session takes care of handling the template library that maps template IDs to templates, and it keeps track of message sequence numbers.
The Session class's contructor is not accessible. Instead these classes must be used: The StreamSession is used when reading data from a file or from a TCP stream. The DatagramSession is used when reading data over UDP.
The companion object for additional details.
A SessionGroup maintains a set of Sessions for a
single transport session.
A SessionGroup maintains a set of Sessions for a
single transport session. Put more carefully, it maintains a
group of sessions that can be distinguished solely by an
observation domain identifier.
A SessionGroup is created to create either StreamSessions or DatagramSessions. A StreamSession is used when reading data from files or over TCP; it supports template withdrawal and re-use of a template ID raises an exception. A DatagramSession is used when reading data over UDP; it does not support template withdrawal and re-use of template IDs is permitted.
transport is an object may be used to describe the transport, such as an
InetSocketAddress for network transports or a Path for a file transport.
It may be null. The SessionGroup does not use this parameter, and the
caller may use it however it chooses.
Creates a session group. Each new session in the group will be created using the given session factory.
the information model
an object that describes the transport of the transport session. It will be an InetSocketAddress for network transports, or a Path for a file transport. May be null.
true when the group is used to read data from a
file or over TCP (creates a StreamSession),
and false for reading data over UDP (creates a
DatagramSession).
Signals that a ListElement may not be added to a Record or a sub-Record may not be added to a List because they have different Session objects.
Extracts the specified field from a Record and casts the field to a type.
Extracts the specified field from a Record and casts the field to a type. Does not descend into any structured data elements (lists) on the Record. To descend into sub-records of the Record, use the DeepFieldExtractor.
Maintains a mapping from Template to field position to improve performance when extracting a field from multiple Records that share the same Template.
The type to cast the field to.
DeepFieldExtractor
The StreamMessageReader is used to get the next Message from a channel.
The StreamMessageReader is used to get the next Message from a channel. An instance of this type is normally created by an InputStreamSession.
The channel to read.
The SessionGroup that holds the InfoModel used to interpret data read from the channel.
There are two types of Sessions: StreamSession and DatagramSession.
There are two types of Sessions: StreamSession and DatagramSession.
A StreamSession implements Template instantiation and Template withdrawal handling as dictated by sections 8 and 8.1 of RFC 7011. In particular, Session.TemplateInterferenceException is thrown when different templates use the same template id.
A StreamSession is created by a SessionGroup with the
streamSemantics parameter set to true.
Session.TemplateInterferenceException when different
templates use the same template id.
A class to represent the contents of an IPFIX SubTemplateList structured data.
A class to represent the contents of an IPFIX SubTemplateList structured data.
A SubTemplateList contains a zero or more instances of Records that match a single IPFIX Template.
The companion object has factory methods that return a CollectedSubTemplateList instance when reading a SubTemplateList or a ExportSubTemplateList instance when generating a SubTemplateList for writing.
A class to represent the contents of an IPFIX SubTemplateMultiList structured data.
A class to represent the contents of an IPFIX SubTemplateMultiList structured data.
A SubTemplateMultiList contains a zero or more instances of Records that match one or more IPFIX Templates.
The companion object has factory methods that return a CollectedSubTemplateMultiList instance when reading a SubTemplateMultiList or a ExportSubTemplateMultiList instance when generating a SubTemplateMultiList for writing.
An IPFIX template that describes the data in a Record.
An IPFIX template that describes the data in a Record.
A template is composed of a sequence of information elements with associated lengths. (The IEFieldSpecifier class bundles the InfoElement and length into a single object.) An element's length in the template may be different than the "natural" length (reduced length encoding), and an element that supports variable-length values may have a fixed size.
If a template has a non-zero scope, the template is an Options Template.
When a Template is added to a Session it is given a unique ID within that Session. A Template may be added to multiple Sessions; there is not necessarily a relationship among the IDs given to a Template in the different Sessions.
1.3.1 The description is set and fixed at Template creation.
A class to represent an information element within a template where the element may have a specific length that is different than the default length.
Extracts Template metadata from a Record.
Extracts Template metadata from a Record.
The extracted data includes the name and description of a Template which is referenced by its Template id. The RecordReader uses that information to update the Templates that it parses.
A TemplateSet represents a IpfixSet that contains one or more Templates or Option Templates.
A TemplateSet represents a IpfixSet that contains one or more Templates or Option Templates.
To create a TemplateSet from an input ByteBuffer, use IpfixSet.fromBuffer.
To create a TemplateSet for export, use TemplateSet.empty to create an empty TemplateSet and then call TemplateSet.addTemplate to add Templates to it.
The companion object for more details.
Signals that there is not enough data available to read the Message.
An ArrayRecord factory.
A BasicList factory and supporting classes.
A BasicListFieldExtractor factory.
A CollectedMessage factory.
A CollectedRecord factory.
IPFIX Information Element Data Types as defined in RFC5102
IPFIX Information Element Data Types as defined in RFC5102
A description of the abstract data type of an IPFIX Information Element as defined in Section 3.1 of RFC5102.
See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-data-types
May be converted to and from Short values.
Holds constants and methods used by DeepFieldExtractor.
Maximum number of bytes that can be written to a single IPFIX mesage not including the message header.
Contains private methods to support the ExportBasicList class.
An ExportStream factory.
An ExportStreamTemplatesFirst factory.
Contains private methods to support the ExportSubTemplateList class.
Contains private definitions to support the ExportSubTemplateMultiList class.
A FieldSpec factory.
An IEFieldSpecifier factory.
IPFIX Information Element Semantics as defined in RFC5610
IPFIX Information Element Semantics as defined in RFC5610
A description of the semantics of an IPFIX Information Element. These are taken from the data type semantics defined in Section 3.2 of the IPFIX Information Model (RFC5102); see that section for more information on the types described below. The special value 0x00 (default) is used to note that no semantics apply to the field; it cannot be manipulated by a Collecting Process or File Reader that does not understand it a priori.
See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-semantics
May be converted to and from Short values.
IPFIX Information Element Units as defined in RFC5610
IPFIX Information Element Units as defined in RFC5610
A description of the units of an IPFIX Information Element. These correspond to the units implicitly defined in the Information Element definitions in Section 5 of the IPFIX Information Model (RFC5102); see that section for more information on the types described below. The special value 0x00 (none) is used to note that the field is unitless.
See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-information-element-units
May be converted to and from Short values.
The IPFIX version identifier
A factory for Identifier instances.
An InfoElement factory.
An InfoElementBuilder factory.
An InfoElementMetadata factory.
An InfoModel factory.
Find and open an information model registry XML file, given the base name of the file.
Find and open an information model registry XML file, given the base name of the file. This presumes that such files will exist as resources under /org/cert/netsa/io/ipfix/registries.
A InputStreamSession factory.
An IpfixSet factory.
IPFIX Structured Data (List) Type Semantics as defined in RFC6313
IPFIX Structured Data (List) Type Semantics as defined in RFC6313
Structured data type semantics are provided in order to express the relationship among multiple list elements in a Structured Data Information Element.
See https://www.iana.org/assignments/ipfix/ipfix.xhtml#ipfix-structured-data-types-semantics
May be converted to and from Short values.
Maximum valid template ID
Minimum valid template ID
Holds constants related to the Message trait.
Set identifier for options template sets
A Record copier.
A RecordSet factory.
Defines traits for classes that are used as callbacks on a Session.
A SimpleFieldExtractor factory.
A StreamMessageReader factory.
A SubTemplateList factory.
A SubTemplateMultiList factory.
Set identifier for template sets
A Template factory.
A TemplateMetadata factory.
A TemplateSet factory.
Element size that represents a variable-length element
The
ipfixpackage provides classes and objects for reading and writing IPFIX data.Class / Object Overview
(For a quick overview of the IPFIX format, see the end of this description.)
The Message trait describes the attributes of an IPFIX message, and the CollectedMessage class and object are implementations of that trait when reading data. (Record export does not create specific Message instance.)
The IpfixSet abstract class and object hold the attributes of a Set. The TemplateSet class may represent a Template Set or an Options Template Set.
The Template class and object are used to represent a Template Record or an Options Template Record.
The IEFieldSpecifier class and object represent a Field Specifier within an existing Template. To search for a field within a Template, the user of the
ipfixpackage creates a FieldSpec (the companion object) and attempts to find it within a Template.The Field Specifier uses the numeric Identifier to identify an Information Element, and an Element is represented by the InfoElement class and object. The InfoModel class and object represent the Information Model.
To describe the attributes of an
InfoElement, several support classes are defined: DataTypes is an enumeration that describes the type of data that the element contains, and DataType is a class that extracts a Field Value with thatDataType. IESemantics describes the data semantics of an Information Element (e.g., a counter, an identifier, a set of flags), and IEUnits describes its units.The Data Set is represented by the RecordSet class and object.
A Data Record is represented by the Record abstract class. This class has three subclasses:
A user-defined class that extends Fillable trait may use the Record's fill() method to copy fields from a Record to the user's class. It also uses the IPFIXExtract annotation.
A Structured Data Field Value in a Data Record is represented by the ListElement abstract class. That abstract class has three abstract subclasses, and each of those has two concrete subclasses (one for reading and one for writing):
Reading data
When reading data, a Record instance is returned by a RecordReader. The RecordReader uses a class that extends the MessageReader trait. The
ipfixpackage includes two: ByteBufferMessageReader and StreamMessageReader.A Session value represent an IPFIX session, which is part of a SessionGroup.
Writing data
For writing data, an instance of an ExportStream must be created using a Session and the destination FileChannel. The user adds Records or Templates to the ExportStream and they are written to the FileChannel.
Overview of IPFIX
An IPFIX stream is composed of Messages. Each Message has a 16-byte Message Header followed by one or more Sets. There are three types of Sets: A Data Set, a Template Set, and an Options Template Set.
Each Set has a 4-byte set header followed by one or more Records. A Data Set contains Data Records and a Template Set contains Template Records.
A Template Record describes the shape of the data that appears in a Data Record. A Template Record contains a 4-byte header followed by zero or more Field Specifiers. Each Field Specifier is either a 4-byte or an 8-byte value that describes a field in the Data Record.
A Field Specifier has two parts. The first is the numeric Information Element Identifier that is defined in an Information Model. The second is the number of octets the field occupies in the Data Record.
A Data Set contains one or more Data Records of the same type, where the type is determined by the Template Record that the Data Set Header refers to. Each Data Record contains one or more Field Values, where the order and length of the Field Values is given by the Template.
A Field Value in a Data Record may be a Structured Data. There are three types of Structured Data:
An IPFIX stream exists in a Transport Session, where a Transport Session is part of a Session Group. All Sessions in a Session Group use the same Transport Protocol, and only differ in the numeric Observation Domain that is part of the Message Header.